Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-privilege local access
  2. Delivery
    Set network.persocket.filter with shell metacharacters
  3. Exploit
    PMDA metric refresh invokes shell
  4. Execution
    Execute arbitrary commands as PMDA user
  5. Impact
    Access or tamper with PMDA-accessible data

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the linux_sockets PMDA to be installed and active in PCP, and the attacker must be able to set the network.persocket.filter metric value (local, low-privilege access per CVSS AV:L/PR:L). Execution is triggered on the PMDA's metric-refresh cycle rather than instantly, and the resulting command runs only with the PMDA user's privileges, not root by default. Systems that do not deploy the linux_sockets PMDA, or that prevent untrusted users from writing metric values, are not exposed; there is no remote unauthenticated path.
Impact

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) frames this as a local, low-complexity, low-privilege issue with full confidentiality, integrity, and availability impact but no scope change - consistent with code execution confined to the PMDA user's context rather than a network-facing compromise. The description's phrase 'via the network' refers to the network-metrics domain of the linux_sockets PMDA, not a remote network attack vector; the CVSS AV:L should be trusted over a literal reading of that wording - verify with the vendor if remote reachability of the metric-set interface is a concern in a given deployment. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input. On balance this is a real local-escalation/lateral-impact concern on systems where the linux_sockets PMDA is deployed and untrusted users can set metric values, but the absence of network vector, active-exploitation signals, and public exploit code places it below internet-facing critical issues in prioritization.
Exploit ScenarioDerived

A local user with the low privileges needed to set PCP metric values assigns a network.persocket.filter value containing shell metacharacters (e.g. a value that appends a semicolon and a command). When the linux_sockets PMDA next refreshes its metrics, the injected command executes with the PMDA user's privileges, allowing the attacker to run arbitrary commands and read or tamper with data accessible to that account. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 1.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

RemediationAI

Apply the updated pcp packages from Red Hat once released for your RHEL major version (6 through 10) or OpenShift Container Platform 4 - no vendor-released fixed version is stated in the available data, so consult https://access.redhat.com/security/cve/CVE-2026-16524 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2506023 for the exact patched build and errata. As a compensating control until patched, disable or unload the linux_sockets PMDA (remove it from the active PMDA configuration / stop it via the PCP PMDA management so the network.persocket.* metrics are not collected), accepting the trade-off of losing per-socket network metrics; alternatively restrict which local users can write metric values and tightly limit local access to the PCP collector (pmcd) socket, since the flaw requires the ability to set the offending metric. Avoid running the affected PMDA in shared or multi-tenant hosts where untrusted local users are present.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

PCP (Performance Co-Pilot) is a distributed metrics collection framework used for system and application performance monitoring on Linux. Metrics are gathered by Performance Metric Domain Agents (PMDAs); the linux_sockets PMDA exposes per-socket network statistics, including a configurable filter exposed through the network.persocket.filter metric. The root cause is CWE-78 (OS Command Injection): the value supplied for this filter metric is passed into a shell context without validation or sanitization, so shell metacharacters embedded in the metric value are interpreted rather than treated as literal data when the PMDA refreshes its metric values. The affected CPEs enumerate the pcp component as delivered in red_hat_enterprise_linux_6 through red_hat_enterprise_linux_10 and red_hat_openshift_container_platform_4.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local metric-write access needed (AV:L, PR:L) with no user interaction; injected command runs as the PMDA user granting full C/I/A within that context, no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

Executive ViewAI

Why It Matters

A privilege escalation vulnerability in Performance Co-Pilot affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, allowing authenticated users to execute arbitrary commands with elevated system privileges. Organizations running these platforms face elevated insider-threat risk and must act to limit exposure among users with local system access.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce strict authentication and access controls limiting PCP access to trusted administrators; (2) Disable the linux_sockets PMDA if not operationally critical; (3) Run PCP PMDA processes with minimal necessary privilege level; (4) Implement logging and alerting on PCP metrics collection for anomalous command execution patterns; (5) Apply network segmentation to restrict access to PCP interfaces.

Threat Intelligence Overview

EPSS Score
1.1%
Top 38% exploitable
Prevalence
Medium
PCP ships broadly with RHEL, but linux_sockets PMDA is optional and often not deployed
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 1.1%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-16524 ADVISORY https://vuldb.com/vuln/384490 REF https://access.redhat.com/errata/RHSA-2026:55560 REF https://access.redhat.com/errata/RHSA-2026:55617 REF https://access.redhat.com/errata/RHSA-2026:55740 REF https://access.redhat.com/errata/RHSA-2026:72272 REF https://access.redhat.com/errata/RHSA-2026:72273 REF https://access.redhat.com/errata/RHSA-2026:72593 REF https://access.redhat.com/errata/RHSA-2026:72594 REF https://access.redhat.com/errata/RHSA-2026:73767 REF https://access.redhat.com/errata/RHSA-2026:74612 REF https://access.redhat.com/errata/RHSA-2026:74613 REF https://access.redhat.com/security/cve/CVE-2026-16524 REF https://bugzilla.redhat.com/show_bug.cgi?id=2506023

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy